CVE-2026-96566

Name of the Vulnerable Software and Affected Versions The Newsletter – Send awesome emails from WordPress versions prior to 9.4.1

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server and executed in the browser of users who visit the affected page. The issue exists in the subscription endpoint 'na=sa', which lacks nonce verification, capability checks, and CAPTCHA. Attackers can bypass email-address validation by embedding the {profile 1} placeholder in the local part of the email address, as the is email() function permits curly braces. This allows the injection of arbitrary web scripts via the np1 custom field parameter.

Recommendations Update The Newsletter – Send awesome emails from WordPress to version 9.4.1 or later. As a temporary mitigation, restrict access to the 'na=sa' subscription endpoint.